Sucuri WordPress Plugin CVE-2026-73033

Exploitation requires an authenticated WordPress administrator session - the CVSS 4.0 vector confirms PR:H (high privileges). The Sucuri Security plugin must be installed and active in a version at or below 2.7.3. The attacker must be able to submit a POST request to the WordPress admin area with a manipulated sucuriscan_integrity parameter targeting the pageIntegritySubmission() method. Limiting factors: administrator-level credentials are a hard prerequisite, ruling out unauthenticated or subscriber/editor-level attackers; exploitation is scoped to WordPress environments with this specific plugin installed and active; the attack does not provide code execution or data exfiltration directly - its impact is file deletion (integrity and availability), not confidentiality compromise.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H) scores 7.0, reflecting network reachability and high integrity/availability impact but tempered by the PR:H (high privilege) requirement. The real-world attacker pool is meaningfully constrained: exploitation requires a valid WordPress administrator session, limiting the threat primarily to compromised admin credentials, malicious co-administrators, or insider abuse. The absence of a CISA KEV listing suggests no confirmed mass exploitation. However, a publicly available exploit lowers the skill bar once credentials are obtained, and the impact - deleting wp-config.php - is immediately catastrophic (full site outage) and can facilitate a WordPress reinstallation takeover. EPSS data is not available in the supplied intelligence. Compared against the raw CVSS score, real-world priority should be moderate: the PR:H requirement significantly narrows exploitability relative to the high impact score, but the public PoC warrants prompt patching for any environment where admin credentials may be shared or at risk.

An attacker who has obtained WordPress administrator credentials - through phishing, credential stuffing, or brute-force against a site with weak admin passwords - logs into the WordPress dashboard and triggers the Sucuri plugin's integrity check submission with a crafted sucuriscan_integrity value such as ../../../../wp-config.php. The plugin resolves the path to the actual wp-config.php file and calls unlink() on it, deleting the database configuration file and rendering the site inaccessible. A publicly available exploit for this exact mechanism exists, lowering the technical barrier to execution once admin access is secured.